CVE-2020-29509: 
Go vulnerability analysis and mitigation

The encoding/xml package in Go (all versions) contains a vulnerability (CVE-2020-29509) that fails to correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips. This vulnerability was discovered and disclosed on December 14, 2020, affecting all versions of the Go programming language (NVD, Mattermost Advisory).

The vulnerability allows attackers to craft XML inputs that behave inconsistently during different stages of processing in affected downstream applications. The issue received a CVSS v3.1 base score of 5.6 (Medium) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L, though it was initially rated higher by some organizations. The vulnerability is classified under CWE-115: Misinterpretation of Input (NVD, Mattermost Advisory).

The vulnerability can lead to incorrect or conflicting decisions in affected applications, particularly in security-sensitive scenarios. Equivalent lookups within an XML document can return different results during different stages of the document's lifecycle. In SAML implementations, this could lead to authentication bypass and arbitrary privilege escalation within the scope of a SAML Service Provider (Mattermost Advisory).

The vulnerability requires network access and high attack complexity. While no authentication is required, the attack requires specific conditions to be met in the target application. The vulnerability has been particularly concerning for applications that rely on XML integrity for security-sensitive decisions, such as SAML and XML-DSig implementations (NVD, Mattermost Advisory).

A workaround has been provided through the github.com/mattermost/xml-roundtrip-validator module, which can detect unstable constructs in XML documents, including unstable attribute namespace prefixes. Applications can prevent exploitation by validating untrusted markup using this validator and failing early if it returns an error. Notably, Golang upstream does not consider the issue to be fixable in Go and has shifted responsibility to SAML packages (Mattermost Advisory, Debian Tracker).